CAS-004 Security Architecture — 30 Questions

Question 1

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

Accepted Answer

Isolating workloads at the virtual network interface level with granular security policies. Micro-segmentation creates isolated zones for each workload, enabling granular security policies that restrict lateral movement even within the same network segment.

Answer

Creating a single perimeter around the entire network

Answer

Using VLANs to separate departments

Answer

Implementing a VPN for remote access

Question 2

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are handled by the provider (e.g., physical security) and which by the customer (e.g., data access).

Answer

Zero trust

Answer

Software-defined perimeter

Answer

Defense in depth

Question 3

A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides dedicated private network connectivity from on-premises to AWS, offering low latency and security without internet exposure.

Answer

Site-to-site VPN over the internet

Answer

AWS Client VPN

Answer

AWS Transit Gateway with internet gateway

Question 4

A company is deploying a cloud access security broker (CASB) to gain visibility into shadow IT. Which mode of operation would allow the CASB to inspect traffic without requiring proxy configuration on endpoints?

Accepted Answer

API-based mode. API-based mode uses cloud provider APIs to access logs and metadata, providing visibility without inline traffic interception or endpoint changes.

Answer

Reverse proxy mode

Answer

Inline mode

Answer

Forward proxy mode

Question 5

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

Accepted Answer

Pod Security Policies. Pod Security Policies (or Pod Security Admission) enforce security standards for pods, such as preventing privileged containers.

Answer

Secrets management

Answer

Network policies

Answer

RBAC

Question 6

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

Accepted Answer

CRYSTALS-Kyber. CRYSTALS-Kyber is a key encapsulation mechanism (KEM) selected by NIST for post-quantum cryptography.

Answer

RSA-4096

Answer

ECDHE

Answer

CRYSTALS-Dilithium

Question 7

During a security assessment, a penetration tester discovers that a web application fails to validate the size of user input, leading to a buffer overflow. Which application security control would have BEST prevented this vulnerability?

Accepted Answer

Input validation. Input validation ensures that data conforms to expected formats and sizes, preventing malformed input from causing overflows.

Answer

Static application security testing (SAST)

Answer

Web application firewall (WAF)

Answer

Rate limiting

Question 8

An organization wants to enforce that only signed container images are deployed in production. Which of the following should be implemented?

Accepted Answer

Image signing and verification in the registry. Image scanning verifies signatures and checks for vulnerabilities; however, to enforce only signed images, the registry must require signature verification.

Answer

Network policies

Answer

Container runtime security (e.g., seccomp)

Answer

Admission controllers

Question 9

A company is deploying a SASE architecture. Which component is responsible for securing web traffic and enforcing acceptable use policies at the edge?

Accepted Answer

Secure Web Gateway (SWG). A Secure Web Gateway (SWG) is a core SASE function that filters web traffic and enforces security policies like URL filtering and malware detection.

Answer

Zero Trust Network Access (ZTNA)

Answer

Cloud Access Security Broker (CASB)

Answer

SD-WAN

Question 10

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

Accepted Answer

Hardware Security Module (HSM). A hardware security module (HSM) provides secure generation, storage, and management of cryptographic keys in a tamper-resistant device.

Answer

Certificate Revocation List (CRL)

Answer

Key Management Service (KMS)

Answer

Certificate Authority (CA)

Question 11

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

Accepted Answer

Multiple services share the same symmetric key. Using a shared symmetric key means any service with the key can forge tokens, compromising authentication integrity.

Answer

The token is not encrypted

Answer

The token does not include audience claim

Answer

Token expiration is not set

Question 12

An organization wants to enforce consistent security policies across multiple cloud providers (AWS, Azure, GCP). Which tool is designed to continuously monitor and remediate misconfigurations in cloud environments?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) automates the detection and remediation of cloud misconfigurations across multiple providers.

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 13

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

Accepted Answer

List of all open-source components and their versions. An SBOM lists open-source components and their versions, enabling vulnerability tracking. Dependency analysis helps identify known vulnerabilities in those components.

Answer

Penetration testing results

Answer

Employee background checks

Answer

Network flow logs

Question 14

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

Accepted Answer

Least privilege access with just-in-time privileges. Identity-centric zero trust focuses on strong authentication, least privilege, and continuous verification of identity for every access request.

Answer

Implicit trust based on network location

Answer

Single static firewall perimeter

Question 15

A company is implementing a defense-in-depth strategy for its web application. Which THREE of the following are layers that should be included? (Select THREE.)

Accepted Answer

Application security controls (WAF, input validation). Defense in depth uses multiple security layers: network controls, application security, and data protection are key layers.

Answer

Single sign-on (SSO) without MFA

Answer

Physical security of the data center

Question 16

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

Accepted Answer

Identity-based access policies. In a zero-trust model, identity is the primary security boundary. Micro-segmentation uses identity and context to enforce least-privilege access, regardless of network location.

Answer

VPN concentrators

Answer

Network address translation

Answer

Perimeter firewalls

Question 17

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

Accepted Answer

IaaS. In IaaS, the customer manages the OS, applications, and data, while the provider secures the physical infrastructure. SOC 2 compliance requires customer to handle many controls.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 18

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

Accepted Answer

API mode. API mode uses the SaaS provider's APIs to access data and logs, enabling inspection without proxying traffic or installing agents. It can analyze encrypted data via API calls.

Answer

Inline proxy

Answer

Forward proxy

Answer

Reverse proxy

Question 19

A company needs to connect its on-premises data center to a public cloud provider with low latency and high bandwidth while avoiding the public internet. Which connectivity method should be used?

Accepted Answer

Direct Connect. Direct Connect (or ExpressRoute) provides a dedicated private connection from on-premises to the cloud, bypassing the internet for better performance and security.

Answer

Client VPN

Answer

Site-to-site VPN

Answer

SD-WAN

Question 20

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

Accepted Answer

SWG. SWG (Secure Web Gateway) is the SASE component that provides security inspection for all traffic, regardless of user location, by enforcing policies and protecting against web-based threats. It inspects all outbound traffic from users, whether on-premises or remote, to ensure security compliance.

Answer

ZTNA

Answer

CASB

Answer

SD-WAN